ELF

Introduction ELF stands for executable and linkable file format. Also called as Extensible Linking Format. ELF is used as standard file format for object files

on Linux. ELF supports :

Different processors

Different data encoding

Different classes of machines

ELF Object Files

A file that contains compiled code is known as an object file.An Object file can be any of the following types

1.Relocatable object file (.o file)

2.Executable object file (a.out file)

3.Shared object file (.so file)

An object file participates from program building to its execution or we can say from linking to execution stage.

Relocatable file

This type of object file contains data and code that can be linked together with other relocatable files to produce an executable binary or a shared object file.

A relocatable file is same as the .o file produced when we compile a code in the following way

gcc -Wall -c test.c -o test.o test.o produced after the operation above would be

a relocatable file.

Shared object file This type of object file is used by the dynamic

linker to combine it with the executable and/or other shared object files to create a complete process image.

A shared object file is same as the .so file produced when the code is compiled with the -fPIC flag in the following way

gcc -c -Wall -Werror -fPIC shared.c

gcc -shared -o libshared.so shared.o After the above two commands are done, a shared

object file libshared.so is produced as output.

Executable file

This type of object file is a file that is capable of executing a program when run.

It is output of commands like this

gcc -Wall test.c -o test So, the output ‘test’ would be an executable which

when run would execute the logic written in test.c file.

ELF object file formatELF header

Program header table

.text

.data

.rodata

.bss

.sym

.rel.text

.rel.data

.rel.rodata

.line

.debug

.strtab

Section header table

File layout Each ELF file is made up of one ELF header,

followed by file data. The file data can include

1.Program header table, describing zero or more segments.

2.Section header table, describing zero or more sections.

The segments contain information that is necessary for runtime execution of the file.

The sections contain important data for linking and relocation.

Various sectionsFile header The ELF header defines whether 32- or 64-bit addresses are to be used.

.text This section holds executable instructions of a program.

Type: PROGBITS

Flags: ALLOC + EXECINSTR

.data This section holds initialized data that contributes to the program’s

image.

Type: PROGBITS

Flags: ALLOC + WRITE

.rodata This section holds read-only data.

Type: PROGBITS

Flags: ALLOC

.bss This section holds uninitialized data that contributed to the

program’s image.

By definition, the system will initialize the data with zero when the program begins to run.

Type: NOBITS

Flags: ALLOC + WRITE

.rel.text, .rel.data, and .rel.rodata These contain the relocation information for the corresponding text

or data sections.

Type: REL

Flags: ALLOC is turned on if the file has a loadable segment that includes relocation.

.symtab This section hold a symbol table.

.strtab This section holds strings.

.init This section holds executable instructions that contribute to the

process initialization code.

Type: PROGBITS

Flags: ALLOC + EXECINSTR

.fini This section hold executable instructions that contribute to the

process termination code.

Type: PROGBITS

Flags: ALLOC + EXECINSTR

.debug This section holds symbolic debugging information.

Type: PROGBIT

.line This section holds line number information for symbolic debugging,

which describes the correspondence between the program source and the machine code.

Type: PROGBIT

.comment This section may store extra information.